From 9d5c340130ac056e7558468cc61872db65140c9b Mon Sep 17 00:00:00 2001 From: Rajat Dhasmana Date: Mon, 11 May 2020 08:21:09 +0000 Subject: [PATCH] Don't show host info to non-admins While getting volume details, if the user is a non-admin then hide the host name. Change-Id: Iaf0ac52d9227f9a0efbf32b1faca78c8456a84ca Closes-Bug: #1740950 --- cinder/api/v2/views/volumes.py | 7 +++-- ...fo-in-volume-details-1759280bd236421e.yaml | 27 +++++++++++++++++++ 2 files changed, 32 insertions(+), 2 deletions(-) create mode 100644 releasenotes/notes/fix-host-info-in-volume-details-1759280bd236421e.yaml diff --git a/cinder/api/v2/views/volumes.py b/cinder/api/v2/views/volumes.py index 302aebb46b8..c2d9a0dbe99 100644 --- a/cinder/api/v2/views/volumes.py +++ b/cinder/api/v2/views/volumes.py @@ -91,7 +91,11 @@ class ViewBuilder(common.ViewBuilder): 'multiattach': volume.get('multiattach'), } } - if request.environ['cinder.context'].is_admin: + ctxt = request.environ['cinder.context'] + if not ctxt.is_admin: + if volume_ref.get('attachments'): + volume_ref['volume']['attachments']['host_name'] = None + if ctxt.is_admin: volume_ref['volume']['migration_status'] = ( volume.get('migration_status')) @@ -100,7 +104,6 @@ class ViewBuilder(common.ViewBuilder): group_id = volume.get('group_id') if group_id is not None: # Not found exception will be handled at the wsgi level - ctxt = request.environ['cinder.context'] grp = group_api.API().get(ctxt, group_id) cgsnap_type = group_types.get_default_cgsnapshot_type() if grp.group_type_id == cgsnap_type['id']: diff --git a/releasenotes/notes/fix-host-info-in-volume-details-1759280bd236421e.yaml b/releasenotes/notes/fix-host-info-in-volume-details-1759280bd236421e.yaml new file mode 100644 index 00000000000..8887746cd48 --- /dev/null +++ b/releasenotes/notes/fix-host-info-in-volume-details-1759280bd236421e.yaml @@ -0,0 +1,27 @@ +--- +upgrade: + - | + Due to the fix for `Bug #1740950 + `_, the + ``host_name`` field in any object in the ``attachments`` + array of the volume detail response is populated only when + the call is made in an administrative context. Otherwise, + its value is the JSON ``null`` value. This is consistent with + prior API behavior, as it has always been possible for the + value of that field to be ``null``. +security: + - | + It was possible under certain circumstances for the host name + of an instance to be leaked in the volume detail response. This + has been fixed in the current release. The ``host_name`` field + in any object in the ``attachments`` array of the volume + detail response is populated only when the call is made in an + administrative context. Otherwise, its value is the JSON ``null`` + value. +fixes: + - | + `Bug #1740950 `_: + the ``host_name`` field in any object in the ``attachments`` array + of the volume detail response is populated only when the call is + made in an administrative context. Otherwise, its value is the + JSON ``null`` value. \ No newline at end of file